NIS2 Certification: Does It Exist, and What Does Evidence Cost?

Written by the NIS2Compass editorial team / As of: October 2026

There is no NIS2 certification. The BSI is clear: "There is no general certificate proving compliance with the requirements" (translated). Costs arise for gap analyses (a consultant day averages EUR 1,300 according to the BDU) and for voluntary certificates, such as the BSI fee of EUR 2,978 for initial ISO 27001 certification on the basis of IT-Grundschutz. You can build the evidence the BSI may request with the templates in the NIS2Compass Template Library.

Is There an Official NIS2 Certification?

No. The BSIG does not provide for a certificate attesting a company's NIS2 compliance, and the BSI confirms this in its FAQ. Anyone selling a "NIS2 certificate" is selling a private assessment, not official evidence.

The question comes up because the BSIG does use the word "certification", but with a different meaning. § 2 BSIG defines certification as a finding by a certification body that a product, a process, a system, a person or an IT security service provider meets certain requirements. The subject is a single object of assessment, not the company as a NIS2 entity.

In the NIS2 context you will therefore come across three kinds of certificates:

• Management system certificates: ISO/IEC 27001 or ISO 27001 on the basis of IT-Grundschutz. They can be one building block of your evidence, but they do not replace it.
• Private company certificates: For example under VdS 10000. According to the BSI FAQ, such a certification on its own is "not sufficient to meet all requirements of the BSIG" (translated), but it can be a building block for § 30 BSIG.
• Product certificates: § 30 (6) BSIG allows an ordinance under which certain ICT products may only be used with a cybersecurity certification under European schemes of the Cybersecurity Act. The basis is Article 24 of the NIS2 Directive, which concerns certified ICT products, services and processes, not the entity itself.

According to the BSI statistics "NIS-2 in Zahlen", 20,141 entities had registered under NIS-2 in the BSI portal by 30 September 2026, including 13,252 important and 6,837 essential entities. None of them can obtain an official NIS2 certificate. NIS2Compass therefore recommends investing in implementation and documentation rather than in a seal.

Who Has to Provide NIS2 Evidence, and When?

Without being asked, only operators of critical facilities, every three years under § 39 BSIG. Essential and important entities provide evidence when the BSI orders it or carries out an inspection. Ongoing documentation under § 30 (1) sentence 3 BSIG is mandatory for everyone.

The BSI puts it this way in its FAQ: companies only have to prove that they have implemented the statutory requirements "on request in the event of an order by the BSI" (translated). That is no reason to relax: failing to document your measures is already an administrative offence under § 65 (2) No. 3 BSIG.

The fine range for it reaches up to EUR 10 million for essential and EUR 7 million for important entities. When and how the BSI may audit depends on the type of entity:

• Essential entities (§ 61 BSIG): The BSI can already order individual entities today to have audits, inspections or certifications carried out by independent bodies (para. 1). From further essential entities it can request evidence under para. 3 from 6 December 2028 at the earliest, three years after the act entered into force. Independently of this, the BSI may check compliance itself at any time under para. 5, including on-site inspections and requests for documents.
• Important entities (§ 62 BSIG): The BSI may only audit if facts justify the assumption that obligations are not being met or not met correctly. One trigger could be a security incident that has become known. Measures under § 61 are then possible as well.
• Operators of critical facilities (§ 39 BSIG): Evidence through security audits, inspections or certifications, first at a date set by the BSI and every three years thereafter. The BSI informed operators individually of their new deadlines on 8 December 2025.

For licensed hospitals, § 61 (3) sets five instead of three years, unless an ordinance sets an earlier date. Which entities the BSI selects for evidence orders is governed by § 61 (4) BSIG: risk exposure, size, and the likelihood and severity of potential incidents.

What Counts as Evidence, and What Does ISO 27001 Contribute?

The BSI lists documentation, audit reports, audits or certifications as evidence, and for reporting obligations also your own incident reports. An ISO 27001 certificate is a good foundation, but according to the BSI it does not count as evidence of NIS2 compliance. What matters is that every obligation under §§ 30, 32 and 38 BSIG is demonstrably implemented.

In an audit under § 61 or § 62 BSIG, the BSI checks risk management measures (§§ 30, 31), the reporting obligation (§ 32) and management's duties to implement, oversee and train (§ 38). According to the BSI information package on ISO/IEC 27001, the standard answers these requirements "only incompletely or not at all" (translated): the scope can be chosen freely, risk acceptance is permitted, and explicit statutory obligations such as reporting and registration are missing. How far an existing certificate takes you is covered in Is ISO 27001 Enough for NIS2 Compliance?.

The BSI does not prescribe any particular standard, and a certificate is not a prerequisite. The evidence package itself therefore has to convince. In practice, a structure along the obligations works well:

• Risk management (§ 30): Risk analysis, security concept and, for each of the ten minimum measures in § 30 (2), the corresponding document with date and owner.
• Effectiveness: Results of internal audits, penetration tests or exercises showing that the measures actually work.
• Reporting (§ 32): Reporting process, contact availability and, if any, the reports you have submitted.
• Management (§ 38): Resolution on implementing and overseeing the measures, plus training records.

The templates in the NIS2Compass Template Library are mapped to exactly this evidence.

NIS2 Certification Cost: What Do a Gap Analysis, an Audit and a Certificate Cost?

A NIS2 gap analysis costs consultant days times the day rate: according to the BDU fee study 2025, the average day rate is EUR 1,300, so a quote of EUR 8,000 corresponds to about six days. There is no official NIS2 certification that could incur costs. For initial certification under ISO 27001 on the basis of IT-Grundschutz, the BSI charges a fee of EUR 2,978.

The day rates come from the fee study of the German Association of Management Consultants (BDU). On average they range from EUR 700 (analyst) to EUR 1,600 (partner), across all consulting fields. Whether a quote is fair depends less on the total than on the number of days and what they deliver.

When reviewing a quote for a gap analysis, look at the benchmark first: is it checked against all ten measures in § 30 (2) BSIG, plus the reporting process and management duties? A plain list of ISO deviations does not cover that. The result matters just as much: a prioritised action plan with named owners beats a traffic light, and interviews, document review and a final presentation should be included.

For one certification route there are official prices. According to the BMIBGebV (the BMI fee ordinance), initial certification under ISO 27001 on the basis of IT-Grundschutz costs EUR 2,978 at the BSI, recertification EUR 2,658, plus any expenses such as travel costs. That is only the fee of the certification body. On top comes the fee of the BSI-certified auditor who prepares the audit report.

Private certification bodies have no official price list. And an audit by the BSI itself? Under § 61 (5) BSIG, the BSI only charges essential entities fees if it acted because of indications justifying reasonable doubt about the implementation of § 30. If the BSI acts without such indications, you only bear your own effort.

For a full cost breakdown see NIS2 compliance costs, for consultant pricing What does external NIS2 consulting cost?.

How Often Is There a NIS2 Audit, and How Long Does It Take?

A fixed NIS2 audit cycle only exists for operators of critical facilities: every three years. The BSI only audits important entities if facts point to deficiencies, while it can check essential entities without a specific reason under § 61 (5) BSIG. An ISO 27001 certificate on the basis of IT-Grundschutz is valid for three years, with annual surveillance audits.

Several cycles run in parallel, none officially called a "NIS2 audit". For operators of critical facilities, the BSI FAQ states: "With the entry into force of the NIS-2 Implementation Act, the evidence cycle is extended from two to three years" (translated). According to the BSI certification scheme, an initial certificate under ISO 27001 on the basis of IT-Grundschutz is "valid for three years and combined with annual surveillance audits" (translated), followed by recertification.

For management training, the BSI quotes the explanatory memorandum to the act: training counts as regular if it is offered at least every three years. The BSI considers this minimum sufficient only in the rarest of cases. For essential entities, the 6 December 2028 date only applies to evidence orders under § 61 (3), not to individual orders under para. 1 or inspections under para. 5.

How long an audit takes depends on its scope, not on a statutory requirement. The BSIG does not set a standard duration for audits under § 61. What you can plan is your own lead time: the documentation the BSI may request must already exist.

Once an order arrives, there is no time left to build it. So ask: what would need to be on the table tomorrow?

A Customer Demands a "NIS2 Certificate": What Do You Provide?

A mechanical engineering company with 180 employees is registered as an important entity. Mechanical engineering is listed in Annex 2 BSIG, and the threshold is 50 employees or more than EUR 10 million in both annual turnover and balance sheet total. A major customer asks for "a valid NIS2 certificate" in its supplier questionnaire, and the IT manager has to reply by the end of the month.

The BSI answers exactly this question in its FAQ (No. 10): there is no general certificate. If the customer is itself subject to NIS2, it must address the risks posed by its service providers under § 30 BSIG and can take an ISO 27001 certification into account, for example. So the customer needs proof that you meet your obligations, not a stamp.

The IT manager therefore assembles an evidence package without disclosing the ISMS. It contains the registration confirmation under § 33 BSIG and a self-declaration along the ten measures in § 30 (2), each with its implementation status and corresponding document. Added to this are management's resolution on implementing and overseeing the measures with the training record under § 38 BSIG, a short description of the reporting cascade under § 32 and, if available, the ISO 27001 certificate with its scope.

The customer then sees which obligation is implemented and how. If you use NIS2Compass, you can additionally share your documented progress via a verification code that the customer checks in the NIS2 supplier verification. For the IT manager, the package also lays the groundwork for any later inspection under § 62 BSIG.

Frequently Asked Questions

Is There a NIS2 Certification for Companies?

No. The BSI makes clear that there is no general certificate proving compliance with the NIS2 requirements. Private assessments and management system certificates such as ISO 27001 can be building blocks of your evidence. They do not attest NIS2 compliance and replace neither the documentation under § 30 BSIG nor registration and reporting.

What Does NIS2 Certification Cost?

There is no official NIS2 certification, so there is no price for it either. Costs arise for voluntary certificates: at the BSI, initial certification under ISO 27001 on the basis of IT-Grundschutz costs a fee of EUR 2,978 under the BMIBGebV, plus the auditor's fee. There is no official price list for private certification bodies.

Do I Have to Prove NIS2 Implementation to the BSI on a Regular Basis?

Only as an operator of a critical facility, in which case every three years under § 39 BSIG. Essential and important entities provide evidence when the BSI orders it or carries out an inspection. Everyone has to document on an ongoing basis: missing documentation is an administrative offence under § 65 BSIG in its own right.

From When Can the BSI Require Evidence From Essential Entities?

The BSI can already order individual audits or inspections under § 61 (1) BSIG today and check compliance itself at any time under para. 5. Only evidence orders to further essential entities under § 61 (3) are possible from 6 December 2028 at the earliest. For licensed hospitals the period there is five years.

How Much Does a NIS2 Gap Analysis Cost?

The cost is consultant days times the day rate. According to the BDU fee study 2025, the average day rate is EUR 1,300, with averages from EUR 700 (analyst) to EUR 1,600 (partner). A quote of EUR 8,000 corresponds to about six consultant days. Check whether the analysis covers all obligations under the BSIG.